Serious Flaw: POODLE SSL 3.0

A bug has been found in the Secure Sockets Layer (SSL) 3.0 cryptography protocol (SSLv3) which could be exploited to intercept data that is supposed to be encrypted between computers and servers. Three Google security researchers discovered the flaw and detailed how it could be exploited through what they called a Padding Oracle On Downgraded Legacy Encryption (POODLE) attack (CVE-2014-3566). 

 

It is important to note that this is NOT a flaw in SSL certificates, their private keys or their design but in the old SSLv3 protocol. SSL Certificates are not affected and customers with certificates on servers supporting SSL 3.0 do not need to replace them.

This flaw is highly likely not to be as serious as the Heartbleed bug in OpenSSL, since the attacker needs to have a privileged position in the network to exploit the latest. The usage of Hotspots, public Wi-Fi, makes this attack a real problem. This type of attack is a “Man-in-the-middle” attack. 

Solution:

1. Check to see if SSL 3.0 is disabled on your browser (for example in Internet Explorer it is under Internet Options, Advanced Settings).
2. Make sure “HTTPS” is always on the websites you visit to avoid MITM attacks.
3. Monitor any notices from the vendors who you use regarding recommendations to update software or passwords.
4. Avoid potential phishing emails from attackers who ask you to update your password. Stick with the official site domain to avoid going to an impersonated website.

Shellshock: Very Serious Vulnerability

The flaw has been found in a software component known as Bash, which is a part of many Linux systems as well as Apple's Mac operating system.

The bug called Shellshock, can be used to take control of almost any system remotely using Bash (Bourne-Again Shell, a command prompt on many Unix computers. Unix is an operating system on which many others are built, such as Linux and Mac OS.).

500,000 machines worldwide are thought to be vulnerable to Heartbleed. But early estimates, which experts said were conservative, suggest that Shellshock could hit at least 500 million machines. 

 

US Cert issued an advisory here: https://www.us-cert.gov/ncas/current-activity/2014/09/24/Bourne-Again-Shell-Bash-Remote-Code-Execution-Vulnerability

You can check to see if your system is vulnerable here: https://shellshocker.net/

Heartbleed: Very Serious SSH Bug

The Heartbleed bug is a serious vulnerability in the popular OpenSSL cryptographic software library and this weakness allows stealing the information protected under normal conditions by the SSL/TLS encryption used to secure the internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (im) and some virtual private networks (VPNs).

The Heartbleed bug allows everyone on the internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and impersonate services and users.

Although OpenSSL is very popular there are other SSL/TLS options. In addition some web sites use an earlier unaffected version and some didn't enable the heartbeat feature that was central to the vulnerability.

While the implementation of perfect forward secrecy or PFS, a practice that makes sure encryption keys have a very short shelf life, and are not used forever reduces the impact of the potential damage, but it doesn't solve the problem. That means if an attacker got an encryption key from a server's memory, the attacker will not be able to decode all secure traffic from that server because keys use is very limited. While some tech giants like Google and Facebook have started to support PFS, not every company supports it.

How to avoid being affected:

1. Do not log into accounts from afflicted sites until you are sure that the company has patched the problem
2. You can check sites on an individual basis using checkers such as https://lastpass.com/heartbleed/
3. When you received confirmation of a security patch, change passwords of sensitive accounts
4. Monitor your account statements for the next few days in case of any of your accounts was affected